CVE-2026-73223 is a path traversal vulnerability in the electerm SFTP client's editWithSystemEditor feature, allowing a malicious or compromised SFTP server to write arbitrary files to the client's local filesystem. The vulnerability stems from a fundamental trust misclassification: the client accepts the server-supplied filename and passes it directly to path.resolve against a temp directory, without sanitizing traversal sequences. Because path.resolve merely anchors paths rather than validating them, a server can send a filename like ../../home/.bashrc to escape the intended directory and achieve arbitrary file write. The CVSS 8.1 score reflects the trivially satisfiable precondition—an attacker need only host a honeypot SFTP server or compromise an existing one; no social engineering is required since developers routinely configure clients to connect to multiple servers.
The patched version (3.15.120) presumably adds a canonicalization check ensuring the resolved path remains within the intended temp directory. However, historical precedent suggests caution: the path.normalize plus startsWith pattern has been bypassed before through TOCTOU race conditions (symlinks created after validation but before write), Unicode normalization differences, and case-insensitivity on Windows/macOS. The fix implementation matters—if it uses only string comparison without atomically verifying the final path, bypasses likely exist.
Defenders should prioritize three actions: first, verify electerm is updated to 3.15.120 or later; second, audit other code paths where server-sourced data (filenames, timestamps, permissions, symlink targets) feeds into client-side file operations—this vulnerability class suggests the same trust failure likely exists elsewhere in the codebase; third, review configured SFTP servers and consider rotating credentials for any server where trust is uncertain, since the vulnerability inverts the normal SFTP model where the client controls local filenames. The broader implication is that SFTP clients implementing server-to-client file-naming workflows (common in terminal emulators and IDE plugins) likely share this pattern—this CVE should prompt systematic audits of similar features across the ecosystem.